authhttp

type ActionAvailability struct {
	Action            string     `json:"action"`
	Allowed           bool       `json:"allowed"`
	Reason            string     `json:"reason,omitempty"`
	RetryAfterSeconds int64      `json:"retry_after_seconds,omitempty"`
	NextAllowedAt     *time.Time `json:"next_allowed_at,omitempty"`
	Limit             *int       `json:"limit,omitempty"`
	Remaining         *int       `json:"remaining,omitempty"`
	WindowSeconds     *int64     `json:"window_seconds,omitempty"`
	CooldownSeconds   *int64     `json:"cooldown_seconds,omitempty"`
}

type Claims struct {
	UserID          string
	Email           string
	EmailVerified   bool
	Username        string
	DiscordUsername string
	SessionID       string
	Roles           []string
	// GlobalRoles are the user's GLOBAL (platform-wide) roles, carried in the
	// `global_roles` claim in both single and multi-org mode. Use these for
	// global-admin authorization decisions.
	GlobalRoles []string
	Org         string
	// OrgRoles are the roles scoped to the org named in Org, carried in the
	// `org_roles` claim on org-scoped tokens. Use these for org-scoped authz.
	OrgRoles     []string
	Entitlements []string
	Issuer       string
	UserTier     string
	JTI          string

	// Delegated/federated fields. A delegated platform token carries the
	// external user in DelegatedSubject (claim `delegated_sub`) and the
	// federated org in Tenant (claim `tenant`, falling back to `org`). It never
	// carries `sub` (UserID stays empty), so the local-user gate does not apply.
	Tenant           string
	DelegatedSubject string
}

type ClientIPFunc func(r *http.Request) string

type DelegatedPrincipal struct {
	Tenant           string
	DelegatedSubject string
	UserTier         string
	Roles            []string
	Issuer           string
}

type DelegatedTokenParams struct {
	// Issuer is the platform issuer URL (becomes the `iss` claim) — must match a
	// federated issuer registered with the validating resource server.
	Issuer string
	// Audiences becomes the `aud` claim (the resource servers this token targets).
	Audiences []string
	// DelegatedSubject is the federated user id (becomes `delegated_sub`). Required.
	DelegatedSubject string
	// Tenant is the federated org slug (becomes `org` + `tenant`).
	Tenant string
	// UserTier becomes `user_tier` (the platform's tier for this user).
	UserTier string
	// Roles becomes `roles` (platform-scoped roles for this user).
	Roles []string
	// TTL is the token lifetime. Defaults to 15m when zero.
	TTL time.Duration
}

type FederatedIssuerSource interface {
	ListFederatedOrgIssuers(ctx context.Context, activeOnly bool) ([]core.FederatedOrgIssuer, error)
	// GetFederatedOrgIssuer fetches a SINGLE federated-org issuer by its
	// issuer_id, used by the lazy-load-on-miss path in keyForToken. *core.Service
	// already implements this.
	GetFederatedOrgIssuer(ctx context.Context, issuerID string) (*core.FederatedOrgIssuer, error)
}

type FederationClient struct {
	// contains filtered or unexported fields
}

type FederationClientOption func(*FederationClient)

type FederationRegistration struct {
	// Org is THIS org's slug (becomes the `org`/tenant claim of delegated tokens).
	Org string
	// IssuerID is THIS platform's issuer URL (the `iss` of delegated tokens).
	IssuerID string
	// JWKSURL is where the resource server fetches THIS platform's public keys.
	JWKSURL string
}

type InternalErrorEvent struct {
	Route  string
	Stage  string
	Code   string
	Method string
	Path   string
	Err    error
}

type IssuerKey struct {
	KID          string
	PublicKeyPEM string
}

type IssuerOptions struct {
	// JWKSURL is the URL to fetch JWKS from. If set, keys are fetched
	// automatically and refreshed when they expire or an unknown kid appears.
	JWKSURL string

	// Keys are pre-provided public keys as PEM. The caller is responsible for
	// refreshing by calling AddIssuer again with updated keys.
	Keys []IssuerKey

	// RawKeys are pre-provided public keys. Useful when the caller already
	// has parsed *rsa.PublicKey values (e.g., from a co-located core.Service).
	RawKeys map[string]*rsa.PublicKey

	// CacheTTL controls how long fetched JWKS keys are considered fresh.
	// Default: 5 minutes.
	CacheTTL time.Duration

	// MaxStale controls how long stale keys may be used as fallback after
	// a failed JWKS refresh. Default: 1 hour.
	MaxStale time.Duration
}

type LanguageConfig struct {
	Supported  []string
	Default    string
	QueryParam string
	CookieName string
}

type Limit struct {
	Limit    int
	Window   time.Duration
	Cooldown time.Duration
}

type RateLimitResult struct {
	Allowed      bool
	RetryAfter   time.Duration
	Availability *ActionAvailability
}

type RateLimiter interface {
	AllowNamed(bucket string, key string) (bool, error)
}

type RateLimiterWithResult interface {
	AllowNamedResult(bucket string, key string) (ratelimit.Result, error)
}

type RateLimiterWithRetryAfter interface {
	AllowNamedWithRetryAfter(bucket string, key string) (bool, time.Duration, error)
}

type RouteGroup string

type RouteSpec struct {
	Method  string
	Path    string
	Group   RouteGroup
	Handler http.Handler
}

type Routes struct {
	// contains filtered or unexported fields
}

type Service struct {
	// contains filtered or unexported fields
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifierOption func(*Verifier)